Upgrade core deps and modernize lint stack

[jhesch]

Brings the toolchain up to current versions to unblock @actions/github
v9 and @octokit/rest v22 (both now ESM-only).

• TypeScript 4.3 -> 5.9; tsconfig switched to ES2022 / module esnext /
  moduleResolution bundler with skipLibCheck for octokit interop.
• Jest 26 -> 30, ts-jest 26 -> 29, nock 13 -> 14 (needed for fetch
  interception now that @octokit/request uses native fetch). Jest
  config moved to ESM mode (useESM, extensionsToTreatAsEsm,
  --experimental-vm-modules).
• Replaced @typescript-eslint/parser v4 + eslint v7 +
  eslint-plugin-github v4 with eslint 9 + typescript-eslint 8;
  migrated config from .eslintrc.json to flat eslint.config.js. Drops
  the github preset (transitive bloat for rules we don't use) and the
  ts-eslint stylistic rules now owned by @Stylistic.

Source adjustments for the new APIs:

• octokit.repos.X -> octokit.rest.repos.X
• guarded response.data.files (now optional) and coerced
  DiffEntry.sha (now string | null)
• narrowed unknown error before reading .message
• replaced ternary-as-statement and removed unnecessary type
  assertion that the new lint rules flagged

Tests updated for ESM imports and Jest 30 (toThrowError -> toThrow).